SamoaNational Digital Identification Act 2024, registered persons' data-subject rights
National Digital Identification Act 2024, No. 3 (Samoa), s. 51 (registered persons' rights)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- On a registered person's request, confirm without unreasonable delay and at no expense whether personal data relating to them is being stored or processed, and provide a copy in a paper-based or commonly used electronic format.NIST Privacy FrameworkCT.DM-P1
- On a registered person's request, correct or, where correction is not feasible, delete personal data that is inaccurate, out of date, incomplete, or misleading, or that the National Digital Identification System or relying party is not entitled to retain.NIST Privacy FrameworkCT.PO-P3
- On a registered person's request, disclose what personal data has been accessed, when, by whom, the purpose, manner and duration of access, how long the data will be stored, and whether any profiling or automated decision-making process is being applied to it.NIST Privacy FrameworkCM.AW-P4
- Implement measures that let a registered person effectively exercise these access, correction, and information rights, and provide a way to lodge a grievance over improper use of their data.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
What the log must hold
Event time, Actor identity, Access record
Logging duty
Section 51(1)(f) gives a registered person the right to be told what personal data from the National Digital Identification System was accessed, when, by whom and to whom it was disclosed, and the purpose, manner and duration of access. That cannot be answered without a kept record of each access, although the section names no log, retention period or audit. The registered person is the party the access detail is given to.
- Kind
- Implicit
- As of
- Provision
- Section 51(1)(f)
- Trigger
- personal_data_processing
What this law does
Section 51(1) gives a registered person the right to obtain from the Registrar General or a relying party, without constraint or unreasonable delay and at no expense, confirmation of whether their personal data is being processed, a copy of it in a paper-based or commonly used electronic format, correction or deletion of inaccurate, out-of-date, incomplete, or misleading data, and detailed information on what data has been accessed, by whom, for what purpose and duration, how long it will be stored, and whether any profiling or automated decision-making process is being applied to it.
Section 51(2) requires the Registrar General and a relying party to implement measures enabling a registered person to exercise these rights effectively. Section 52 clarifies that registration confers no right of citizenship, and section 53 lets a registered person raise a grievance over any improper use of their data.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .